Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Plant Nutrition Diagnosis Skill | 植物营养诊断技能

v1.0.0

Diagnoses plant nutrient deficiency or excess based on computer vision and plant physiology, outputs targeted fertilization suggestions for precision nutrien...

0· 63·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for smyx-sunjinhui/smyx-plant-nutrition-diagnosis-analysis.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Plant Nutrition Diagnosis Skill | 植物营养诊断技能" (smyx-sunjinhui/smyx-plant-nutrition-diagnosis-analysis) from ClawHub.
Skill page: https://clawhub.ai/smyx-sunjinhui/smyx-plant-nutrition-diagnosis-analysis
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install smyx-plant-nutrition-diagnosis-analysis

ClawHub CLI

Package manager switcher

npx clawhub@latest install smyx-plant-nutrition-diagnosis-analysis
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The declared purpose (plant nutrition diagnosis) matches the presence of scripts/plant_nutrition_diagnosis_analysis.py and a Skill implementation that calls remote analysis APIs. However the package also bundles a large shared module (skills/smyx_common) and a full 'face_analysis' skill set. The face-analysis files appear unrelated to plant nutrition and inflate the package footprint; this may be code reuse but is unexpected for a single-purpose skill.
!
Instruction Scope
SKILL.md contains strict runtime rules (e.g., absolute prohibition on reading local memory files) while simultaneously prescribing reading local config files (skills/smyx_common/scripts/config.yaml) to obtain open-id and instructing automatic saving of uploaded attachments into the skill directory. The code also creates/uses a local SQLite DB under the workspace data directory. These behaviors contradict the 'do not read local memory' rule and broaden what the agent will access and persist.
Install Mechanism
There is no install spec (instruction-only install), so nothing is downloaded during install — lowest install risk. However the repo includes a very large requirements.txt inside skills/smyx_common (many third-party packages), which is disproportionate for a simple CV client and suggests heavy runtime dependencies if someone tries to install them.
Credentials
The skill declares no required env vars, which aligns with the registry metadata, but runtime code reads environment variables (OPENCLAW_SENDER_OPEN_ID, OPENCLAW_SENDER_USERNAME, FEISHU_OPEN_ID) via the common config initializer and also reads local config yaml files that declare base API endpoints and api-key fields. The skill will upload user images/files to external API endpoints configured in those files — users should confirm those endpoints and any api-key values. No unrelated cloud credentials are requested, but the ability to read local config files and environment variables is notable.
!
Persistence & Privilege
The common DAO creates an SQLite DB under the workspace data directory and the skill may save or reference historical reports via API or local storage. SKILL.md forbids reading from local 'memory' files but the code persists/reads local DB/config; this indicates the skill will store data on disk and maintain state in the workspace, which has privacy implications.
What to consider before installing
Before installing or running this skill: - Understand where images and reports will be sent: the code uses configured remote API endpoints (config files point to lifeemergence/open API URLs). If you will send sensitive images, confirm and trust the service endpoints and any API keys. - The SKILL.md forbids reading local memories but the code reads local config files and creates a local SQLite DB under the workspace/data directory; expect local persistence of metadata and possibly uploaded filenames — review skills/smyx_common/scripts/config.yaml and the DAO behavior. - The package bundles a separate face-analysis skill and a large requirements list (smyx_common). This is likely code reuse but increases dependency surface; consider running in a sandboxed environment and inspect/lock down network access before giving it real data. - The skill enforces acquiring an open-id from local config or user input. Do not provide highly privileged secrets; if asked for api-key values, verify their purpose and target service. - If you need a lower-risk test, run the supplied scripts with dummy inputs and capture network traffic (or run in an isolated network) to confirm which endpoints are contacted and what data is transmitted. Given the contradictions between the documented 'no local memory reads' rule and the code that reads/writes local config/DB, review and possibly request the maintainer clarify these behaviors before use.
!
skills/smyx_common/scripts/config-dev.yaml:2
Install source points to URL shortener or raw IP.
About static analysis
These patterns were detected by automated regex scanning. They may be normal for skills that integrate with external APIs. Check the VirusTotal and OpenClaw results above for context-aware analysis.

Like a lobster shell, security has layers — review code before you run it.

latestvk971zfs0eeff7zwsketh2bb4qx853n5t
63downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Plant Nutrition Diagnosis Skill | 植物营养诊断技能

Based on computer vision technology combined with professional plant physiology knowledge, this skill accurately diagnoses nutrient imbalance disorders such as nitrogen, phosphorus, potassium deficiency or excess, as well as trace element abnormalities by analyzing the color, texture and morphological characteristics of plant leaves. The system quickly locates the type of nutrient imbalance based on "symptom location" (such as the difference between old leaves and new leaves) and "visual pattern" (such as interveinal chlorosis, leaf margin scorch), and outputs a structured diagnostic report including nutrient deficiency judgment, physiological cause analysis, and targeted fertilization suggestions. It provides scientific basis for precision fertilization and crop health management, helping growers quickly correct nutrient disorders and maintain healthy plant growth.

本技能结合计算机视觉技术与专业植物生理学知识,通过分析植物叶片的颜色、纹理和形态特征,能够精准诊断氮、磷、钾大量元素缺乏或过剩以及微量元素异常等营养失衡病症。系统依据" 症状发生部位"(如老叶与新叶的差异)及"视觉表现模式" (如叶脉间失绿、叶缘焦枯),快速定位营养失衡类型,输出包含缺乏元素判断、生理成因分析及针对性施肥建议的结构化诊断报告,为精准施肥与作物健康管理提供科学依据,帮助种植者快速矫正营养失调,维持植物健康生长。

演示案例

⚠️ 强制记忆规则(最高优先级)

本技能明确约定:

  • 绝对禁止读取任何本地记忆文件:包括但不限于 memory/YYYY-MM-DD.mdMEMORY.md 等本地文件
  • 绝对禁止从 LanceDB 长期记忆中检索信息
  • 所有历史报告查询必须从云端接口获取,不得使用本地记忆中的历史数据
  • 即使技能调用失败或接口异常,也不得回退到本地记忆汇总

任务目标

  • 本 Skill 用于:通过叶片视频/图片诊断植物营养状况,判断缺乏或过剩的营养元素,输出科学施肥建议
  • 能力包含:叶片特征提取、营养元素缺乏/过剩诊断、成因分析、施肥建议输出
  • 支持场景:
    • 大田作物营养诊断:指导大田作物精准施肥,提高肥料利用率
    • 果园蔬菜施肥管理:果树蔬菜营养失衡快速诊断
    • 设施园艺:温室作物营养状况监测与矫正
    • 居家绿植养护:家庭盆栽黄叶、长势差等问题营养诊断
    • 农业科研试验:作物营养试验症状自动化记录与诊断
  • 触发条件:
    1. 默认触发:当用户提供植物叶片视频/图片需要诊断营养状况时,默认触发本技能
    2. 当用户明确需要植物营养诊断、缺肥判断时,提及叶子发黄、叶片失绿、缺氮缺磷、怎么施肥、营养诊断等关键词,并且上传了视频/图片,自动触发本技能
    3. 当用户提及以下关键词时,自动触发历史报告查询功能 :查看历史诊断报告、营养诊断报告清单、诊断报告列表、查询历史诊断报告、显示所有诊断报告、植物营养分析报告,查询植物营养诊断分析报告
  • 自动行为:
    1. 如果用户上传了附件或者视频/图片文件,则自动保存到技能目录下 attachments
    2. ⚠️ 强制数据获取规则(次高优先级):如果用户触发任何历史报告查询关键词(如"查看所有诊断报告"、" 显示所有植物营养诊断"、" 查看历史报告"等),必须
      • 直接使用 python -m scripts.plant_nutrition_diagnosis_analysis --list --open-id 参数调用 API 查询云端的历史报告数据
      • 严格禁止:从本地 memory 目录读取历史会话信息、严格禁止手动汇总本地记录中的报告、严格禁止从长期记忆中提取报告
      • 必须统一从云端接口获取最新完整数据,然后以 Markdown 表格格式输出结果

前置准备

  • 依赖说明:scripts 脚本所需的依赖包及版本
    requests>=2.28.0
    

诊断要求(获得准确结果的前提)

为了获得准确的营养诊断,请确保:

  1. 典型症状叶片:拍摄具有典型症状的叶片,避免完全正常或完全坏死无法辨认的叶片
  2. 特征完整展示:整张叶片完整出镜,包括叶片基部、尖部和叶缘
  3. 自然光下拍摄:光线均匀,避免严重色差和反光,真实反映叶片颜色

操作步骤

🔒 open-id 获取流程控制(强制执行,防止遗漏)

在执行植物营养诊断分析前,必须按以下优先级顺序获取 open-id:

第 1 步:【最高优先级】检查技能所在目录的配置文件(优先)
        路径:skills/smyx_common/scripts/config.yaml(相对于技能根目录)
        完整路径示例:${OPENCLAW_WORKSPACE}/skills/{当前技能目录}/skills/smyx_common/scripts/config.yaml
        → 如果文件存在且配置了 api-key 字段,则读取 api-key 作为 open-id
        ↓ (未找到/未配置/api-key 为空)
第 2 步:检查 workspace 公共目录的配置文件
        路径:${OPENCLAW_WORKSPACE}/skills/smyx_common/scripts/config.yaml
        → 如果文件存在且配置了 api-key 字段,则读取 api-key 作为 open-id
        ↓ (未找到/未配置)
第 3 步:检查用户是否在消息中明确提供了 open-id
        ↓ (未提供)
第 4 步:❗ 必须暂停执行,明确提示用户提供用户名或手机号作为 open-id

⚠️ 关键约束:

  • 禁止自行假设,自行推导,自行生成 open-id 值(如 openclaw-control-ui、default、plant123、id456 等)
  • 禁止跳过 open-id 验证直接调用 API
  • 必须在获取到有效 open-id 后才能继续执行分析
  • 如果用户拒绝提供 open-id,说明用途(用于保存和查询诊断报告记录),并询问是否继续

  • 标准流程:
    1. 准备叶片视频/图片输入
      • 提供本地视频/图片文件路径或网络 URL
      • 确保具有典型症状的叶片完整清晰
    2. 获取 open-id(强制执行)
      • 按上述流程控制获取 open-id
      • 如无法获取,必须提示用户提供用户名或手机号
    3. 执行植物营养诊断分析
      • 调用 -m scripts.plant_nutrition_diagnosis_analysis 处理输入(必须在技能根目录下运行脚本
      • 参数说明:
        • --input: 本地视频/图片文件路径(使用 multipart/form-data 方式上传)
        • --url: 网络视频/图片 URL 地址(API 服务自动下载)
        • --open-id: 当前用户的 open-id(必填,按上述流程获取)
        • --list: 显示历史植物营养诊断分析报告列表清单(可以输入起始日期参数过滤数据范围)
        • --api-key: API 访问密钥(可选)
        • --api-url: API 服务地址(可选,使用默认值)
        • --detail: 输出详细程度(basic/standard/json,默认 json)
        • --output: 结果输出文件路径(可选)
    4. 查看分析结果
      • 接收结构化的植物营养诊断报告
      • 包含:输入基本信息、诊断营养元素、失衡类型(缺乏/过剩)、症状匹配度、成因分析、矫正施肥建议

资源索引

  • 必要脚本:见 scripts/plant_nutrition_diagnosis_analysis.py (用途:调用 API 进行植物营养诊断分析,本地文件使用 multipart/form-data 方式上传,网络 URL 由 API 服务自动下载)

  • 配置文件:见 scripts/config.py(用途:配置 API 地址、默认参数和格式限制)

  • 领域参考:见 references/api_doc.md(何时读取:需要了解 API 接口详细规范和错误码时)

注意事项

  • 仅在需要时读取参考文档,保持上下文简洁
  • 支持格式:jpg/jpeg/png,最大 20MB
  • API 密钥可选,如果通过参数传入则必须确保调用鉴权成功,否则忽略鉴权
  • 诊断结果仅供施肥参考,具体施肥方案请结合土壤检测结果和当地农业技术推广部门建议
  • 禁止临时生成脚本,只能用技能本身的脚本
  • 传入的网络地址参数,不需要下载本地,默认地址都是公网地址,api 服务会自动下载
  • 当显示历史分析报告清单的时候,从数据 json 中提取字段 reportImageUrl 作为超链接地址,使用 Markdown 表格格式输出,包含" 报告名称"、"诊断植株数"、"分析时间"、"点击查看"四列,其中"报告名称"列使用植物营养诊断报告-{记录id}形式拼接, "点击查看" 列使用 [🔗 查看报告](reportImageUrl) 格式的超链接,用户点击即可直接跳转到对应的完整报告页面。
  • 表格输出示例:
    报告名称诊断植株数分析时间点击查看
    植物营养诊断报告-202604142332000011株2026-04-14 23:32:00🔗 查看报告

使用示例

# 诊断本地视频/图片中植物的营养状况(以下只是示例,禁止直接使用openclaw-control-ui 作为 open-id)
python -m scripts.plant_nutrition_diagnosis_analysis --input /path/to/leaf.mp4 --open-id openclaw-control-ui

# 诊断网络视频/图片(以下只是示例,禁止直接使用openclaw-control-ui 作为 open-id)
python -m scripts.plant_nutrition_diagnosis_analysis --url https://example.com/yellow-leaf.mp4 --open-id openclaw-control-ui

# 显示历史诊断报告/显示诊断报告清单列表/显示历史植物营养诊断(自动触发关键词:查看历史诊断报告、历史报告、诊断报告清单等)
python -m scripts.plant_nutrition_diagnosis_analysis --list --open-id openclaw-control-ui

# 输出精简报告
python -m scripts.plant_nutrition_diagnosis_analysis --input leaf.jpg --open-id your-open-id --detail basic

# 保存结果到文件
python -m scripts.plant_nutrition_diagnosis_analysis --input leaf.jpg --open-id your-open-id --output result.json

Comments

Loading comments...